MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4178fe6692a80be53e585e206b75ef98f0ed7542aeec878b759076bc2c93a36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4178fe6692a80be53e585e206b75ef98f0ed7542aeec878b759076bc2c93a36
SHA3-384 hash: b487af97682eb86f71d195e8b65a1264a8ccd2641d51e8b47453a217e3e4658993a5c856bdfff40c9af48c272c430964
SHA1 hash: 80ec46d00006df0248a0419d25a3077110067ada
MD5 hash: f9a102eb5cbd39e21cd3746516d905f0
humanhash: winter-sink-lamp-maryland
File name:ROC - DELHI-Aircraft Parts, -DELHI-Aircraft- airline spares purchase order-Specifications.rar
Download: download sample
Signature AZORult
Create hunting rule
File size:510'094 bytes
First seen:2022-03-15 07:55:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Jn7kL7rKlYZZ7b/qMLKIUPCqT/Zp93qr3SFC1NDIph8:JM7rADLdo3tIX8
TLSH T183B4232DA34CC7A79D4B25D3D0F53B2FD0CC6D926CE60EB4102AD4E7F59126856AB18C
Reporter cocaman
Tags:AZORult rar


Avatar
cocaman
Malicious email (T1566.001)
From: "ROC - DELHI<mayrauizl94@gmail.com>" (likely spoofed)
Received: "from gmail.com (unknown [31.210.20.90]) "
Date: "15 Mar 2022 05:30:40 +0100"
Subject: "ROC - DELHI-Aircraft Parts, SPARES PURCHASE ORDER SPECIFICATION FROM lgpartner.ch.. Date: Am3/15/2022 5:30:39 a.m. Time: 3/15/2022 5:30:39 a.m."
Attachment: "ROC - DELHI-Aircraft Parts, -DELHI-Aircraft- airline spares purchase order-Specifications.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
461
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62304699b94fb38cb482a1b0/reports/e434c23f-e921-4a93-aac3-1d9d4cc88dd4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4178fe6692a80be53e585e206b75ef98f0ed7542aeec878b759076bc2c93a36/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-15 07:56:14 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qly7ztjfkal4u7fqxrann267ghq5v2uflxmq6fxledwxqwjhi3a._file
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/220315-jspx5ahah9/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Azorult
Malware Config
C2 Extraction:
http://89.43.107.198/mpom/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
Link:
https://yomi.yoroi.company/submissions/f4178fe6692a80be53e585e206b75ef98f0ed7542aeec878b759076bc2c93a36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

rar f4178fe6692a80be53e585e206b75ef98f0ed7542aeec878b759076bc2c93a36

(this sample)

AZORult

Executable exe b05adf9ad869adb1c7605901185d74da4ccc5ad49106044a1114cbae8908713a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b05adf9ad869adb1c7605901185d74da4ccc5ad49106044a1114cbae8908713a

Comments